3. Search Processing Language | Splunk Essentials

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

Splunk Essentials - Second Edition

By : Betsy Page Sigman, Soni, Erickson Delgado

3.5 (8)

Splunk Essentials

3.5 (8)

By: Betsy Page Sigman, Soni, Erickson Delgado

Overview of this book

Splunk is a search, analysis, and reporting platform for machine data, which has a high adoption on the market. More and more organizations want to adopt Splunk to use their data to make informed decisions. This book is for anyone who wants to manage data with Splunk. You’ll start with very basics of Splunk— installing Splunk—and then move on to searching machine data with Splunk. You will gather data from different sources, isolate them by indexes, classify them into source types, and tag them with the essential fields. After this, you will learn to create various reports, XML forms, and alerts. You will then continue using the Pivot Model to transform the data models into visualization. You will also explore visualization with D3 in Splunk. Finally you’ll be provided with some real-world best practices in using Splunk.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Splunk in Action

1. Splunk in Action

Your Splunk.com account

Installing Splunk on Windows

Creating a Splunk app

Populating data with Eventgen

Controlling Splunk

Configuring Eventgen

Viewing the Destinations app

Creating your first dashboard

Summary

2. Bringing in Data

2. Bringing in Data

Splunk and big data

Splunk data sources

Creating indexes

Buckets

Data inputs

Splunk events and fields

Extracting new fields

Summary

3. Search Processing Language

3. Search Processing Language

Anatomy of a search

Time modifiers

Filtering search results

Search command - stats

Search command - top/rare

Search commands - chart and timechart

Search command - eval

Search command - rex

Summary

4. Data Models and Pivot

4. Data Models and Pivot

Creating a data model

Data model acceleration

Rearranging your dashboard

Summary

5. Data Optimization, Reports, Alerts, and Accelerating Searches

5. Data Optimization, Reports, Alerts, and Accelerating Searches

Data classification with event types

Data normalization with tags

Data enrichment with lookups

Creating reports

Creating alerts

Search and report acceleration

Scheduling best practices

Summary indexing

Summary

6. Panes of Glass

6. Panes of Glass

Creating effective dashboards

Types of dashboard

Form inputs

Creating a time range input

Creating a radio input

Creating a dropdown input

Static Real-Time dashboard

Creating a map called a choropleth

Summary

7. Splunk SDK for JavaScript and D3.js

7. Splunk SDK for JavaScript and D3.js

Introduction to Splunk SDKs

Practical applications of Splunk's SDK

Creating the final dashboard\jobs.js

Summary

8. HTTP Event Collector

8. HTTP Event Collector

What is the HEC?

How does the HEC work?

How data flows to the HEC?

Summary

9. Best Practices and Advanced Queries

9. Best Practices and Advanced Queries

Temporary indexes and oneshot indexing

Searching within an index

Search within a limited time frame

Quick searches via fast mode

Using event sampling

Splunk Universal Forwarders

Advanced queries

How to improve logs

Summary

Customer Reviews

3.5 (8)

5 star

50%

4 star

0%

3 star

12.5%

2 star

25%

1 star

12.5%

Filtering search results

Splunk is currently one of the best enterprise search engines, that is, a search engine that can serve the needs of any size organization currently on the market. Using a search command, you can filter your results using key phrases just the way you would with a Google search. Here are some examples for you to try out:

SPL> index=main /booking/confirmation

The preceding filters search results and only shows those with /booking/confirmation in the _raw data.

You may also add further filters by adding another phrase. It is very important to note, however, that by default, Splunk will assume that your phrases are logically chained based on an AND operator. For example:

SPL> index=main /booking 200

The preceding line of code is equivalent to the following:

SPL> index=main /booking AND 200

Similarly, you can use the OR operator to find data based on multiple filters. The following command will return all events with /booking or /destinations in the text. It is...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Splunk Essentials

Search

Your notes and bookmarks